CVE-2025-14170
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2Description
The Vimeo SimpleGallery plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 0.2. This is due to missing authorization checks on the `vimeogallery_admin` function hooked to `admin_menu`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary plugin settings via the `action` parameter.
Analysis
Authenticated attackers with WordPress Subscriber-level access and above can modify arbitrary plugin settings in the Vimeo SimpleGallery plugin versions up to 0.2 due to missing authorization checks on the vimeogallery_admin function. The vulnerability allows privilege escalation within WordPress, enabling lower-privileged users to alter plugin configurations they should not have access to. No public exploit code or active exploitation has been identified at the time of analysis.
Technical Context
The Vimeo SimpleGallery WordPress plugin fails to implement proper authorization checks (CWE-862: Missing Authorization) on the vimeogallery_admin function, which is hooked to the admin_menu action. This function processes an action parameter without verifying that the current user has the required administrative capabilities to modify plugin settings. WordPress plugins typically should check user capabilities using functions like current_user_can() with appropriate capability checks (e.g., manage_options) before allowing configuration modifications. The missing check allows any authenticated user, including those with minimal privileges like Subscriber role, to escalate their permissions and modify plugin settings through direct parameter manipulation.
Affected Products
The Vimeo SimpleGallery WordPress plugin is affected in all versions up to and including 0.2. The vulnerable code is present in the vimeo_simplegallery.php file as documented in both the tagged 0.2 release (https://plugins.trac.wordpress.org/browser/vimeo-simplegallery/tags/0.2/vimeo_simplegallery.php#L22) and the development trunk (https://plugins.trac.wordpress.org/browser/vimeo-simplegallery/trunk/vimeo_simplegallery.php#L22). No CPE identifier is available for this WordPress plugin in standard vulnerability databases.
Remediation
The primary remediation is to update the Vimeo SimpleGallery plugin to a patched version beyond 0.2. Plugin administrators should immediately update to the latest available version from the WordPress plugin repository. If a newer patched version is not yet available, administrators should deactivate and remove the plugin until a security update is released. The vulnerability details and remediation guidance are available in the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb28557-7023-481f-a05b-0b9a22d7a456?source=cve. WordPress administrators should also audit plugin settings to ensure no unauthorized modifications were made by lower-privileged users.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today